Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-98982— namespace: don't let a pseudo dentry become the root of a mount

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已被修复： 命名空间：禁止伪目录项（pseudo dentry）成为挂载点的根目录 函数为管道、套接字及其他永远不会成为任何目录项父项或子项的文件分配目录项。这些目录项携带 标志，且 会立即释放它们，因为无锁路径遍历（lockless path walk）永远无法访问到它们。这一机制成立的前提是：此类目录项不得作为任何挂载点的根目录。然而，对这类文件执行类似 的绑定挂载（bind mount）操作，恰恰会使其成为挂载根目录。 大多数 的调用者会将文件置于内核内部挂载点上，而 会拒绝此

CVSS 7.8 · High EPSS 0.16% · P5

Possible ATT&CK Techniques 2 AI

T1562 T1069 · Permission Groups Discovery

Affected Version Matrix 10

VendorProduct Version RangeStatus
Linux Linux 35f96de04127d332a5c5e8a155d31f452f88c76d< a256e31e0c54c4c37d2523aa52faabdcdd2ebc07 affected
35f96de04127d332a5c5e8a155d31f452f88c76d< 7e1c466011ba9e64d43075396badc03191bcee44 affected
35f96de04127d332a5c5e8a155d31f452f88c76d< 00287afa7cd989efdbf5822b7efac33cce7d489a affected
35f96de04127d332a5c5e8a155d31f452f88c76d< b138e16fb1e81376cea89f727dda7bfccd140de4 affected
6.9 affected
< 6.9 unaffected
6.12.113≤ 6.12.* unaffected
6.18.57≤ 6.18.* unaffected
… +2 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-98982

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
namespace: don't let a pseudo dentry become the root of a mount
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: namespace: don't let a pseudo dentry become the root of a mount d_alloc_pseudo() hands out dentries for pipes, sockets and other files that are never anyone's child or parent. They carry DCACHE_NORCU and dentry_free() frees them right away because no lockless path walk can ever reach them. That holds as long as such a dentry isn't the root of a mount. But bind mounting /proc/self/fd/<fd> of such a file does exactly that. Most callers of alloc_file_pseudo() put their files on kernel-internal mounts and may_copy_tree() refuses those. bpf_token_create() doesn't. It places the token file on the bpffs mount the caller handed it and that mount is in the caller's mount namespace so the clone goes through: mount --bind /proc/self/fd/<token> <file> open_tree(tokfd, "", AT_EMPTY_PATH | OPEN_TREE_CLONE) + move_mount() __follow_mount_rcu() then loads ->mnt_root of that mount, reads d_seq and d_flags of the dentry and only then checks mount_lock. The dentry can be gone by then. The final mntput() of an unmounted parent unhooks a child that stayed attached to it under mount_lock alone. When the child's holder does the final put right after that the root is dput() and freed immediately while a walker that found the mount hashed still looks at it. Refuse to clone a mount with a DCACHE_NORCU dentry as its root. Nothing sensible can be done with a bind mount of a bpf token anyway.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 35f96de04127d332a5c5e8a155d31f452f88c76d ~ a256e31e0c54c4c37d2523aa52faabdcdd2ebc07 -
Linux Linux 6.9 -

II. Public POCs for CVE-2026-98982

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-98982

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-98982 (4)

Same Patch Batch · Linux · 2026-10-23 · 217 CVEs total

CVE-2026-98959 9.8 CRITICAL btrfs: fix xattr replace when multiple xattrs are packed in the same item
CVE-2026-99078 9.8 CRITICAL net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
CVE-2026-99079 9.8 CRITICAL net/mlx5e: Prevent stale XSK buffer release on refill retry
CVE-2026-98988 8.8 HIGH namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
CVE-2026-99083 8.8 HIGH ksmbd: fix heap out-of-bounds write in krb5_authenticate()
CVE-2026-99082 8.8 HIGH KVM: x86: Use active memslots for the per-vCPU MMIO cache
CVE-2026-98870 8.8 HIGH ksmbd: remove stale channels from all sessions on teardown
CVE-2026-98980 8.8 HIGH namei: don't reveal overmounted entries in refwalk
CVE-2026-98981 8.8 HIGH namespace: unhash a dentry before detaching the mounts on it
CVE-2026-99042 8.4 HIGH io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6
CVE-2026-98978 8.4 HIGH namespace: never expire a locked mount
CVE-2026-99064 8.1 HIGH cipso: adjust cached option offsets when removing CIPSO
CVE-2026-98968 8.1 HIGH amt: send the relay's General Query directly from the receive path
CVE-2026-99002 7.8 HIGH drm/vmwgfx: validate pitch coming from userspace
CVE-2026-99013 7.8 HIGH Bluetooth: ISO: Reject concurrent BIS listener setup
CVE-2026-99012 7.8 HIGH Bluetooth: ISO: Serialize concurrent connect calls
CVE-2026-99016 7.8 HIGH riscv: futex: untag the user pointer before the atomic access
CVE-2026-99056 7.8 HIGH strparser: make sure __strp_recv isn't running before tearing down the parser
CVE-2026-98899 7.8 HIGH netfilter: ipset: mark the rcu locked areas properly
CVE-2026-99032 7.8 HIGH net/smc: protect clcsock lifetime in smc_getname

Showing top 20 of 217 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux